CWE-89 SQL Injection potential #158

Open

opened

aws-secrets-manager-rotation-lambdas/SecretsManagerRDSMariaDBRotationMultiUser/lambda_function.py

Line 207 in b4b8eca

     cur.execute(new_grant_escaped + " TO %s IDENTIFIED BY %s", (pending_dict['username'], pending_dict['password']))  
 

This should be properly parameterized.

Metadata

Assignees

No one assigned

Labels

No labels

No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests